A privacy scandal shook the tech industry last week: Unroll Me – a popular free service to quickly unsubscribe from newsletters – was allegedly selling data to third parties.
The free service was exploiting user-granted email access to scrape inboxes for the sole purpose of data mining and reselling value. For example, the service would check for Lyft receipts to sell targeted data to Uber. The ordeal created a massive backlash towards Unroll Me but also raised an obvious question: Is this common practice?
Perri Chase, a cofounder of Unroll Me who is no longer affiliated with the service, wrote a lengthy blogpost on Tuesday defending the current CEO. She claims that because the service is free, it HAD to sell data to make money. She insists it’s common practice for providers of free services like Gmail and Facebook.
The analogy between Unroll Me and Google or Facebook is audacious. Not to say haughty.
Facebook and Google are making billions selling ads to targeted audiences. But they don’t sell user data. Yes, they collect information about users gathered through emails, social networking habits, and location, and use that to attract advertisers, but the data stays in-house. Unroll Me and its mother company, Slice, on the other hand, were selling raw data to third parties.
Large, seemingly data-hungry corporations have been scrutinized for years on the use of collected data. They disclose terms of services several times during the onboarding process, offer privacy settings, and ultimately as you are using the service you receive periodic updates on their policy. Their business model is selling ads, not selling data.
Users gave Unroll Me their email credentials to perform a specific task — remove unwanted email subscriptions. Instead these credentials were exploited to mine and sell users’ private data.
One user posted on an image on Twitter of disclosures made by Unroll Me during the onboarding process.
It clearly says “We will never touch your personal stuff”, a claim which seems to be an outright lie. Unroll Me bills itself as a cool, helpful service but functions as invasive spyware. That is neither an industry standard, nor flagrantly misleading users about the privacy of their personal information.
A class action lawsuit against Slice was filed on Wednesday in the Northern California District Court for failing to adequately disclose how the service allegedly harvests valuable data from its users’ accounts. The lawsuit accuses Unroll Me and Slice of violating the Electronic Communications Privacy Act and the Stored Communications Act due to a lack of disclosure during the signup process.
As we all know in this industry, it’s very hard, if not impossible, to recover from such a fiasco. Regardless of the legal verdict, the company has already been found guilty in the eyes of the public. I can’t see any good coming from this lawsuit.
Perri alleges that Unroll Me isn’t doing worse than other providers of free services. I personally refute that line of defense. “Others” won’t make your problem go away. “Others” didn’t get caught cheating, and those who did are no longer operating. Simple fact of life. Trust is earned in drops and lost in buckets. Although I admire Perri’s courage to stand by the company she founded, I can’t accept the explanation that users are fools for not reading the fine print. We don’t read fine print. We read the large print. “We will never touch your personal stuff” is the one sentence we all read, and it was placed in front of our eyes right above the larger button [ACCEPT] for a reason.
Can one bad apple spoil the whole bunch? No. Unroll Me’s privacy faux pas does not represent an industry standard. Consumers aren’t likely to analyze a company’s potential pricing models when signing up for a free service, nor would we want them to. It’s a sad day when users have to assume that if a service is free, they can expect their personal information is being mined, stored, and auctioned off the the highest bidder.
Perri makes a case that the companies who purchase personal data without regard to its source are at fault. She expressly names Uber for its willingness to pay for any information relating to its competition. Unroll Me and its parent company’s blatant blame shifting makes the ordeal doubly distasteful.
As service providers, it’s increasingly important to align our actions with strong ethics. And as a user, I’m going to be more choosy about what services I allow to access my personal information.